I'm just going to put this out there plainly: You don't have a prayer of successfully restricting the machines themselves. Students can tweak, reinstall, use Live CDs, or any other number of things to get around anything that is actually set up on their own machine, and I would even encourage them to do so. It's good to be curious and test the limits, and if the school is going to make that easy to do, then that's their own problem. Now, where you actually have a legitimate chance of doing something useful is on the network side. You can do real filtering there, and it will fit the purpose of preventing non-school-like use during school hours. They'll still be able to do as they please at home, as it should be. I don't know the exact wording of the state law you refer to, but either this should satisfy it or your law needs to be changed. Finally, don't waste too much energy on this. If the funding and competency of your school is anything like most high schools, you're still going to fail, so it's just a matter of making the talking heads at the state regulatory offices think you tried. A real network administrator with proper training might have a chance, but generally the folks setting things up in high schools are no match for high school students. I'll also second the opinion that you should be buying open systems, such as Linux-loaded laptops from System76, Dell, or similar, rather than Macs. You're a school - you should be using technology to help student LEARN, not just teach them to be sheep that know which button to click for certain pre-defined tasks.

MS Outlook-format dump.